[feature] app.locals.csrf - for cross site request forgery protection - exposed in app.locals.csrf